PT-2018-1661 · Microsoft · Win32K+12

Published 2018-08-17 · Updated 2025-10-28 · CVE-2018-8453

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers

Description The issue is related to the Win32k component (win32k.sys) in Windows operating systems, which fails to properly handle objects in memory, allowing an attacker to elevate privileges and execute arbitrary code using a specially crafted application. This can be exploited by ransomware such as Sodinokibi (also known as Sodin) to gain the highest level of privileges on a target system.

Recommendations For Windows 7, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2012 R2, update to a newer version or apply the relevant patch to fix the issue. For Windows RT 8.1, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2008, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2019, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2012, update to a newer version or apply the relevant patch to fix the issue. For Windows 8.1, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2016, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2008 R2, update to a newer version or apply the relevant patch to fix the issue. For Windows 10, update to a newer version or apply the relevant patch to fix the issue. For Windows 10 Servers, update to a newer version or apply the relevant patch to fix the issue. As a temporary workaround, consider restricting access to the Win32k component until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2018-01220

CVE-2018-8453

Affected Products

Win32K

Windows

Windows 10

Windows 10 Servers

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

References · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb · Exploit
• 🔥 https://github.com/ze0r/cve-2018-8453-exp · Exploit
• 🔥 https://github.com/thepwnrip/leHACK-Analysis-of-CVE-2018-8453 · Exploit
• 🔥 https://exploit-db.com/exploits/47134 · Exploit
• 🔥 http://packetstormsecurity.com/files/153669/Microsoft-Windows-NtUserSetWindowFNID-Win32k-User-Callback.html · Exploit
• 🔥 https://securelist.com/cve-2018-8453-used-in-targeted-attack · Exploit
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8453 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8453 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8453 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8453 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01220 · Security Note
• http://securityfocus.com/bid/105467 · Note
• https://t.me/cvenotify/87297 · Telegram Post
• https://securelist.ru/cve-2018-8453-used-in-targeted-attacks/91658 · Note